0

My email server([email protected], ip 1.2.3.4) ---> ISP network ----> Gmail

I built my own email server on my personal computer(ip 1.2.3.4). I also control the domain.

It seems that my ISP can impersonate me to send emails on my behalf.

The threat mode I am imagining is that my ISP allows normal traffic flows in and out but it just sends some emails from time to time on my behalf. My ISP doesn't take away my IP or stop me sending emails or accessing the Internet.

And I think neither SPF, DKIM or DMARC can protect me from that. And TLS is pointless here. My ISP doesn't need to look at my email, it can directly pretend to be me and send emails via plain text or TLS connection.

I was thinking that DKIM can protect me from that threat. But I made a test Can I set dmarc to tell receiver to fail if no DKIM signature provided in email? and it seems that DMARC might not work in this way.

Question:

  1. Is the threat I described feasible? (I may get it wrong, but I think an ISP can do that)

  2. What can I do?

Improve this question

2 Answers 2

Reset to default
1

If an entity other than you (e.g. your ISP, or your email service provider) has control of the domain of your email address (e.g. comcast.net, or gmail.com), then it's possible that this entity could forge messages from you (in that these messages would appear to have been sent from your email address), and do so in such a way that these messages would pass all SPF, DKIM, and DMARC checks.

However, if it is your practice to digitally sign messages that you send (e.g. using S/MIME or GPG or PGP), and your recipients are in the practice of verifying the digital signatures on your messages, then this would prevent these entities from forging messages from you, assuming that these entities do not have the private key that you use to sign your messages.

Improve this answer
5
  • No no. You might misunderstand my question. I control the domain and I build my own email server.
    – Rick
    Commented Apr 27, 2020 at 0:31
  • I see you edited your question to clarify that point. Thank you. In that case, your ISP would still be able to forge messages from you in such a way that they would pass the SPF check - because they can make the messages originate from the IP in your SPF record, because this IP is on their network. However, these messages would not pass the DKIM check, because the ISP would not have the private key corresponding to the public key that you publish in your DKIM record.
    – mti2935
    Commented Apr 27, 2020 at 1:24
  • Yes you are right. My ISP can't have a valid DKIM signature of my domain. But the point is, as for the receiver, if DKIM signature is not provided, and SPF check pass, the receiver would still take it as an valid email. SPF pass, DKIM not provided, Gmail: "Good email". Check my linked question to serverfault:).
    – Rick
    Commented Apr 27, 2020 at 1:28
  • Yes, that's true. But, for that matter, If the recipient isn't checking DKIM or SPF, then anyone (not only your ISP) can spoof a message to make it look like it was sent from your email address.
    – mti2935
    Commented Apr 27, 2020 at 1:35
  • "If the recipient isn't checking DKIM or SPF, then anyone (not only your ISP) can spoof a message to make it look like it was sent from your email address" This is true but it's not related to my question... :( Gmail e.g. of course checks SPF.
    – Rick
    Commented Apr 27, 2020 at 1:44
0

I ran some tests with Gmail, Yandex and 163 mail.

And here's what I got:

My dmarc values looks like this 

v=DMARC1; p=quarantine; rua=mailto:xxx@xxxx; ruf=xxx@xxxx; sp=none; fo=1; pct=100; adkim=r; aspf=r

Tests:

  1. no SPF DNS record, no signing DKIM signture on emails

All emails go to spam folders.

And Gmail gives special warning (If you send email to Gmail through telnet, you get another kind of warning, which looks worse than this yellow warning):

enter image description here

  1. only SPF DNS record, no signing DKIM signture on emails

All emails go to normal "inbox" folders.

  1. only signing DKIM signture on emails, no SPF DNS record

All emails go to normal "inbox" folders.

How Gmail "Orignal Message" looks like under this situation (NEUTRAL with IP xxx.xxx.xxx.xxx):

enter image description here

So if the threat mode I describe is feasible, then only enabling signing DKIM signature on my mail server but without setting SPF DNS record would be a solution to that.

Leave me a comment if you have any advice or noticing any mistakes.

Improve this answer
1
  • Btw, outlook is very strict. With SPF + DKIM, my email still goes to spam folder.
    – Rick
    Commented Apr 27, 2020 at 3:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .